Your standards, checked on GitHub.
Connect the repositories you choose to evaluate pull requests, reviews, checks and deployments. See rule results beside the change. You decide whether the Warestack check is required in branch protection.
GitHub.com organizations · choose your repositories · rules start informational.
Three things on every pull request.
Written as the pull request changes. Each push re-evaluates; each result is kept.
One check per pull request with the result, the standards that passed, the finding and the recommended action. Informational until you require it in branch protection; then it gates the merge.
A single Warestack comment that updates as the pull request changes. No new comment per push, no noise in the thread.
Every evaluation kept with the pull request: which standards ran, on which commit, with what evidence. Queryable in reports and exported as CSV.
Deployments are checked too.
Production deployments and deployment reviews go through the same standards. Who approved, whether they were independent of the requester, whether verification evidence was observed, and whether the change traces to a merged pull request.
Requested by rdiaz · 11:04. Approved by lhartmann · 13:19 · independent of requester. Checks 14 passed · 0 failed. Traces to control-plane #2061 · merged 11:40.
Warestack Rules Passed · 3 deployment standards. Independent production approval · production verification evidence · deployment traceability.
Posted to #deploys · in the daily report with CSV
Standards that read GitHub.
A few rules from the catalog. Each evaluates the change evidence it needs, and starts informational.
Flags pull requests that reach merge with fewer human approvals than their branch prefix requires. Bot approvals never count.
Flags pull requests not linked to a Linear, Jira or GitHub issue.
Flags changes to sensitive paths without an independent approval from an observed code owner.
Flags pull requests over the configured size, excluding lock files.
Flags production deployment reviews approved by the person who requested them.
Flags production deployments that cannot be traced to an observed pull request.
Start with one repository.
An organization admin approves the app once and picks the repositories. Enable a rule to see results on the next matching event.
Review the GitHub App permissions at installation. Rules use change evidence; configured actions publish checks, comments or review requests.